{"id":"CVE-2025-36855","state":"PUBLISHED","title":"EOL .NET 6.0 Runtime Remote Code Execution Vulnerability","description":"A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read.\n\n Per  CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.\n\n  This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176.\n\n \n\n Additionally, if you've deployed  self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd  targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","publishedAt":"2025-09-08T13:57:28.386Z","updatedAt":"2025-09-08T14:06:24.393Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"HeroDevs"},"assigner":"HeroDevs","products":["Microsoft .NET 6.0"],"affected":[{"vendor":"Microsoft","product":".NET 6.0","versions":[{"version":"6.0.0","status":"affected","lessThan":"6.0.36","versionType":"custom"}],"platforms":["Unknown"]}],"references":["https://www.herodevs.com/vulnerability-directory/cve-2025-21176","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176"],"weaknesses":["CWE-126"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/36xxx/CVE-2025-36855.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-36855","state":"PUBLISHED","datePublished":"2025-09-08T13:57:28.386Z","dateUpdated":"2025-09-08T14:06:24.393Z","assignerShortName":"HeroDevs","assignerOrgId":"36c7be3b-2937-45df-85ea-ca7133ea542c","dateReserved":"2025-04-15T23:50:31.198Z"},"containers":{"cna":{"title":"EOL .NET 6.0 Runtime Remote Code Execution Vulnerability","descriptions":[{"lang":"en-US","value":"A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read.\n\n Per  CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.\n\n  This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176.\n\n \n\n Additionally, if you've deployed  self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd  targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry."}],"affected":[{"vendor":"Microsoft","product":".NET 6.0","versions":[{"version":"6.0.0","status":"affected","lessThan":"6.0.36","versionType":"custom"}],"platforms":["Unknown"]}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-21176","name":".NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability","tags":["third-party-advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176","name":".NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-126","description":"CWE-126: Buffer Over-read","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"HeroDevs","orgId":"36c7be3b-2937-45df-85ea-ca7133ea542c","dateUpdated":"2025-09-08T13:57:28.386Z"},"datePublic":"2025-01-14T08:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-08T14:06:12.291326Z","id":"CVE-2025-36855","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-08T14:06:24.393Z"}}]}}}